跳至主要内容

Scenario 2: 花藝設計師僅能查看自己的訂單

User Story: US-002: 角色權限控制

Given: 系統初始狀態​

已登入花藝設計師​

{
  "userId": "designer-001",
  "email": "designer@florist.com",
  "name": "李花藝",
  "roles": ["ROLE_FLORIST"],
  "tenantId": "tenant-abc",
  "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
}

現有訂單資料​

[
  {
    "orderId": "order-001",
    "orderNumber": "ABC-20251031-0001",
    "tenantId": "tenant-abc",
    "assignedFlorist": "designer-001",   // 分配給當前設計師
    "status": "in_production"
  },
  {
    "orderId": "order-002",
    "orderNumber": "ABC-20251031-0002",
    "tenantId": "tenant-abc",
    "assignedFlorist": "designer-001",   // 分配給當前設計師
    "status": "in_production"
  },
  {
    "orderId": "order-003",
    "orderNumber": "ABC-20251031-0003",
    "tenantId": "tenant-abc",
    "assignedFlorist": "designer-002",   // 分配給其他設計師
    "status": "in_production"
  }
]

When: 執行操作​

API 請求：查詢訂單列表​

GET /api/v1/orders HTTP/1.1
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...

後端自動過濾邏輯:

SELECT * FROM orders
WHERE tenant_id = 'tenant-abc'
  AND assigned_ROLE_FLORIST = 'designer-001'  -- 僅返回分配給當前設計師的訂單

Then: 預期結果​

系統響應 (200 OK)​

{
  "data": [
    {
      "orderId": "order-001",
      "orderNumber": "ABC-20251031-0001",
      "status": "in_production",
      "assignedFlorist": "designer-001"
    },
    {
      "orderId": "order-002",
      "orderNumber": "ABC-20251031-0002",
      "status": "in_production",
      "assignedFlorist": "designer-001"
    }
  ],
  "total": 2,
  "page": 1,
  "pageSize": 20
}

注意: order-003 不在結果中（因為分配給其他設計師）

UI 行為​

  1. 「我的任務」頁面顯示 2 筆訂單
  2. 每筆訂單顯示「上傳作品照片」按鈕
  3. 不顯示「創建訂單」按鈕（無權限）
✅ 首頁
✅ 我的任務        (顯示分配給自己的訂單)
❌ 訂單管理       (需要 ROLE_STAFF，隱藏)
❌ 客戶管理       (需要 ROLE_STAFF，隱藏)
✅ 個人設定

邊界條件: 嘗試訪問其他設計師的訂單​

API 請求：直接訪問 order-003​

GET /api/v1/orders/order-003 HTTP/1.1
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...

預期響應 (404 Not Found)​

{
  "error": "NOT_FOUND",
  "message": "訂單不存在",
  "timestamp": "2025-10-31T10:30:00Z"
}

注意: 返回 404 而非 403，避免洩漏資源存在資訊

審計日誌​

{
  "id": "log-001",
  "tenantId": "tenant-abc",
  "userId": "designer-001",
  "userRole": "ROLE_FLORIST",
  "action": "ORDER_ACCESS_DENIED",
  "resourceType": "Order",
  "resourceId": "order-003",
  "status": "FAILED",
  "details": {
    "reason": "NOT_ASSIGNED_TO_USER"
  },
  "timestamp": "2025-10-31T10:30:00Z"
}

最後更新: 2025-10-31